CVE-2026-22036
1 advisory.
npm/undici CVE-2026-22036: medium 5.9
Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion
Action: Upgrade undici to 6.23.0 or later.
npm i undici@7.18.2npm i undici@6.23.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 7.0.0 | 7.18.2 | - |
| 0 | 6.23.0 | - |
Fixed versions
| 7.18.2 | 6.23.0 |
Sources
- osv: GHSA-g9mf-h72j-4rw9
- https://github.com/nodejs/undici/security/advisories/GHSA-g9mf-h72j-4rw9
- https://nvd.nist.gov/vuln/detail/CVE-2026-22036
- https://github.com/nodejs/undici/commit/b04e3cbb569c1596f86c108e9b52c79d8475dcb3
- https://github.com/nodejs/undici
CVE-2026-22036 · published · modified · JSON